ElevenMusic

GDPR overview

ElevenMusic relies on the ElevenLabs privacy policy, linked from the footer and the sign-in screen. It grants the usual GDPR rights — access, rectification, erasure, objection, restriction, portability, withdrawal of consent and complaint to a supervisory authority — exercised through an online form or by writing to the Data Protection Officer at legal@elevenlabs.io. For residents of the EEA, the United Kingdom and Switzerland, the controller for voice data is Eleven Labs Poland sp. z o.o. in Warsaw. Transfers rely on EU standard contractual clauses, adequacy decisions and the EU-US and Swiss-US Data Privacy Framework, whose certification covers the US entity alone. A data processing addendum is published, a subprocessor list is maintained on the compliance portal, and a SOC 2 Type II report is available on written request. No Article 27 representative is designated.

Who owns the data?

Under the terms of service you keep the rights to your prompts and to any music you upload. In exchange, Eleven Labs Inc. receives a licence that is non-exclusive, royalty-free, worldwide and sub-licensable through multiple tiers, covering your uploads, your prompts, your name, image, likeness and voice, and any rights you may hold in the generated output. That licence serves to operate, promote and improve the service and to develop the publisher's other products, and it lasts as long as your content is stored. Other users may comment on, share and remix what you publish, and adaptations already made survive the removal of your original track.

Reuse rights

Reuse is deliberately narrow. The terms state that uploaded music and generated outputs are for use and personal enjoyment within the service only, and may not be downloaded, extracted, licensed, performed, distributed or published elsewhere, including on streaming and user-generated content platforms; you may share links back to the platform, nothing more. The licence granted to you is limited to personal, non-commercial use, except where the publisher opens monetisation through its Creator Royalty Program. Two carve-outs exist: the Pro plan includes ten high-quality WAV downloads per month, and the Sounds library is presented as royalty-free samples and loops usable in anything. On the vendor's side, uploads, prompts and outputs feed model training by default; the 'Data use' menu in the 'Terms and Privacy' section of the account switches that off for the future, with no retroactive effect. Marketing pages nevertheless describe tracks as cleared for broad commercial use, so the current licence should be checked before any professional use.

Data retention & training

Hosting summary

The privacy policy states that hosting and server locations are maintained in the United States, the Netherlands and Singapore, and that all personal data is transferred to the United States for storage regardless of where the user lives. Categories of recipients are listed with examples: cloud providers such as Google Cloud in those three countries, payment processors such as Stripe in the United States, marketing analytics such as Google Analytics, and customer support tools such as Slack. Transfers rely on adequacy decisions, EU and Brazilian standard contractual clauses, and certification under the EU-US and Swiss-US Data Privacy Framework, which covers the US entity only. Customers under the published processing addendum may request data residency in a given jurisdiction, but the addendum makes clear that subprocessors, support staff and the moderation team may still access data from outside that region. On the day of review the site resolved to an anycast address operated by Google.